CVE-2009-3954: Code Injection
First published: Tue Jan 12 2010(Updated: )
The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a "DLL-loading vulnerability."
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/acroread | <0:9.3-1.el4 | 0:9.3-1.el4 |
| redhat/acroread | <0:9.3-1.el5 | 0:9.3-1.el5 |
| Adobe Acrobat Reader | <=9.2 | |
| Adobe Acrobat Reader | =3.0 | |
| Adobe Acrobat Reader | =3.1 | |
| Adobe Acrobat Reader | =4.0 | |
| Adobe Acrobat Reader | =4.0.5 | |
| Adobe Acrobat Reader | =4.0.5a | |
| Adobe Acrobat Reader | =4.0.5c | |
| Adobe Acrobat Reader | =5.0 | |
| Adobe Acrobat Reader | =5.0.5 | |
| Adobe Acrobat Reader | =5.0.6 | |
| Adobe Acrobat Reader | =5.0.10 | |
| Adobe Acrobat Reader | =6.0 | |
| Adobe Acrobat Reader | =6.0.1 | |
| Adobe Acrobat Reader | =6.0.2 | |
| Adobe Acrobat Reader | =6.0.3 | |
| Adobe Acrobat Reader | =6.0.4 | |
| Adobe Acrobat Reader | =6.0.5 | |
| Adobe Acrobat Reader | =6.0.6 | |
| Adobe Acrobat Reader | =7.0 | |
| Adobe Acrobat Reader | =7.0.1 | |
| Adobe Acrobat Reader | =7.0.2 | |
| Adobe Acrobat Reader | =7.0.3 | |
| Adobe Acrobat Reader | =7.0.4 | |
| Adobe Acrobat Reader | =7.0.5 | |
| Adobe Acrobat Reader | =7.0.6 | |
| Adobe Acrobat Reader | =7.0.7 | |
| Adobe Acrobat Reader | =7.0.8 | |
| Adobe Acrobat Reader | =7.0.9 | |
| Adobe Acrobat Reader | =7.1.0 | |
| Adobe Acrobat Reader | =7.1.1 | |
| Adobe Acrobat Reader | =7.1.2 | |
| Adobe Acrobat Reader | =7.1.3 | |
| Adobe Acrobat Reader | =7.1.4 | |
| Adobe Acrobat Reader | =8.0 | |
| Adobe Acrobat Reader | =8.1 | |
| Adobe Acrobat Reader | =8.1.1 | |
| Adobe Acrobat Reader | =8.1.2 | |
| Adobe Acrobat Reader | =8.1.3 | |
| Adobe Acrobat Reader | =8.1.4 | |
| Adobe Acrobat Reader | =8.1.5 | |
| Adobe Acrobat Reader | =8.1.6 | |
| Adobe Acrobat Reader | =8.1.7 | |
| Adobe Acrobat Reader | =9.0 | |
| Adobe Acrobat Reader | =9.1 | |
| Adobe Acrobat Reader | =9.1.1 | |
| Adobe Acrobat Reader | =9.1.2 | |
| Adobe Acrobat Reader | =9.1.3 | |
| Apple iOS and macOS | ||
| Microsoft Windows | ||
| Adobe Acrobat Reader | <=9.2 | |
| Adobe Acrobat Reader | =3.0 | |
| Adobe Acrobat Reader | =3.01 | |
| Adobe Acrobat Reader | =3.02 | |
| Adobe Acrobat Reader | =4.0 | |
| Adobe Acrobat Reader | =4.0.5 | |
| Adobe Acrobat Reader | =4.0.5a | |
| Adobe Acrobat Reader | =4.0.5c | |
| Adobe Acrobat Reader | =4.5 | |
| Adobe Acrobat Reader | =5.0 | |
| Adobe Acrobat Reader | =5.0.5 | |
| Adobe Acrobat Reader | =5.0.6 | |
| Adobe Acrobat Reader | =5.0.7 | |
| Adobe Acrobat Reader | =5.0.9 | |
| Adobe Acrobat Reader | =5.0.10 | |
| Adobe Acrobat Reader | =5.0.11 | |
| Adobe Acrobat Reader | =5.1 | |
| Adobe Acrobat Reader | =6.0 | |
| Adobe Acrobat Reader | =6.0.1 | |
| Adobe Acrobat Reader | =6.0.2 | |
| Adobe Acrobat Reader | =6.0.3 | |
| Adobe Acrobat Reader | =6.0.4 | |
| Adobe Acrobat Reader | =6.0.5 | |
| Adobe Acrobat Reader | =7.0 | |
| Adobe Acrobat Reader | =7.0.1 | |
| Adobe Acrobat Reader | =7.0.2 | |
| Adobe Acrobat Reader | =7.0.3 | |
| Adobe Acrobat Reader | =7.0.4 | |
| Adobe Acrobat Reader | =7.0.5 | |
| Adobe Acrobat Reader | =7.0.6 | |
| Adobe Acrobat Reader | =7.0.7 | |
| Adobe Acrobat Reader | =7.0.8 | |
| Adobe Acrobat Reader | =7.0.9 | |
| Adobe Acrobat Reader | =7.1.0 | |
| Adobe Acrobat Reader | =7.1.1 | |
| Adobe Acrobat Reader | =7.1.2 | |
| Adobe Acrobat Reader | =7.1.3 | |
| Adobe Acrobat Reader | =8.0 | |
| Adobe Acrobat Reader | =8.1 | |
| Adobe Acrobat Reader | =8.1.1 | |
| Adobe Acrobat Reader | =8.1.2 | |
| Adobe Acrobat Reader | =8.1.4 | |
| Adobe Acrobat Reader | =8.1.5 | |
| Adobe Acrobat Reader | =8.1.6 | |
| Adobe Acrobat Reader | =8.1.7 | |
| Adobe Acrobat Reader | =9.0 | |
| Adobe Acrobat Reader | =9.1 | |
| Adobe Acrobat Reader | =9.1.1 | |
| Adobe Acrobat Reader | =9.1.2 | |
| Adobe Acrobat Reader | =9.1.3 | |
| Unix Unix |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.adobe.com/support/security/bulletins/apsb10-02.html
- http://www.vupen.com/english/advisories/2010/0103
- http://www.us-cert.gov/cas/techalerts/TA10-013A.html
- http://www.securitytracker.com/id?1023446
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
- http://secunia.com/advisories/38138
- http://www.securityfocus.com/bid/37761
- http://www.redhat.com/support/errata/RHSA-2010-0060.html
- https://bugzilla.redhat.com/show_bug.cgi?id=554293
- http://secunia.com/advisories/38215
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55552
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8528
- https://www.cve.org/CVERecord?id=CVE-2009-3954 https://nvd.nist.gov/vuln/detail/CVE-2009-3954
- https://access.redhat.com/errata/RHSA-2010:0060
- https://access.redhat.com/errata/RHSA-2010:0038
- https://access.redhat.com/errata/RHSA-2010:0037
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3954.json
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2009-3954?
The CVE-2009-3954 vulnerability is considered critical due to its potential to allow arbitrary code execution.
How do I fix CVE-2009-3954?
To mitigate CVE-2009-3954, upgrade Adobe Reader and Acrobat to version 9.3 or later.
What software is affected by CVE-2009-3954?
CVE-2009-3954 affects Adobe Reader and Acrobat versions 8.x prior to 8.2 and 9.x prior to 9.3 on Windows and Mac OS X.
Can CVE-2009-3954 be exploited remotely?
Yes, CVE-2009-3954 can be exploited remotely through specially crafted PDF files.
Is there a patch available for CVE-2009-3954?
Yes, Adobe has released patches for CVE-2009-3954 in versions 8.2 and 9.3.
- collector/nvd-historical
- agent/type
- agent/first-publish-date
- agent/severity
- agent/remedy
- agent/weakness
- agent/author
- agent/references
- agent/description
- collector/redhat-cve
- source/Red Hat
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/9.2
- version/adobe acrobat reader/3.0
- version/adobe acrobat reader/3.1
- version/adobe acrobat reader/4.0
- version/adobe acrobat reader/4.0.5
- version/adobe acrobat reader/4.0.5a
- version/adobe acrobat reader/4.0.5c
- version/adobe acrobat reader/5.0
- version/adobe acrobat reader/5.0.5
- version/adobe acrobat reader/5.0.6
- version/adobe acrobat reader/5.0.10
- version/adobe acrobat reader/6.0
- version/adobe acrobat reader/6.0.1
- version/adobe acrobat reader/6.0.2
- version/adobe acrobat reader/6.0.3
- version/adobe acrobat reader/6.0.4
- version/adobe acrobat reader/6.0.5
- version/adobe acrobat reader/6.0.6
- version/adobe acrobat reader/7.0
- version/adobe acrobat reader/7.0.1
- version/adobe acrobat reader/7.0.2
- version/adobe acrobat reader/7.0.3
- version/adobe acrobat reader/7.0.4
- version/adobe acrobat reader/7.0.5
- version/adobe acrobat reader/7.0.6
- version/adobe acrobat reader/7.0.7
- version/adobe acrobat reader/7.0.8
- version/adobe acrobat reader/7.0.9
- version/adobe acrobat reader/7.1.0
- version/adobe acrobat reader/7.1.1
- version/adobe acrobat reader/7.1.2
- version/adobe acrobat reader/7.1.3
- version/adobe acrobat reader/7.1.4
- version/adobe acrobat reader/8.0
- version/adobe acrobat reader/8.1
- version/adobe acrobat reader/8.1.1
- version/adobe acrobat reader/8.1.2
- version/adobe acrobat reader/8.1.3
- version/adobe acrobat reader/8.1.4
- version/adobe acrobat reader/8.1.5
- version/adobe acrobat reader/8.1.6
- version/adobe acrobat reader/8.1.7
- version/adobe acrobat reader/9.0
- version/adobe acrobat reader/9.1
- version/adobe acrobat reader/9.1.1
- version/adobe acrobat reader/9.1.2
- version/adobe acrobat reader/9.1.3
- vendor/apple
- canonical/apple ios and macos
- vendor/microsoft
- canonical/microsoft windows
- version/adobe acrobat reader/3.01
- version/adobe acrobat reader/3.02
- version/adobe acrobat reader/4.5
- version/adobe acrobat reader/5.0.7
- version/adobe acrobat reader/5.0.9
- version/adobe acrobat reader/5.0.11
- version/adobe acrobat reader/5.1
- vendor/unix
- canonical/unix unix